Bump golang.org/x/crypto from 0.39.0 to 0.52.0

[dependabot]

Bumps golang.org/x/crypto from 0.39.0 to 0.52.0.

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

[pilotso11]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[pilotso11]

@dependabot rebase

[adv-reviewer]

🔎 zai-reviewer — reviewed bf30ea5, found 1 issue.

[adv-reviewer]

The go directive was raised to go 1.25.0 and the toolchain go1.24.3 directive was removed, but the CI workflow at .github/workflows/go.yml:33 still pins go-version: 1.23. Previously the go directive (1.23.0) matched the CI pin and the toolchain directive (go1.24.3) bridged any gap via GOTOOLCHAIN=auto. Now CI is two versions behind with no toolchain pin. Every CI run silently relies on Go 1.23's GOTOOLCHAIN=auto downloading go1.25.0 from the module proxy (~70 MB per run); if GOTOOLCHAIN is set to local, or the proxy/download is unavailable, CI fails. The stale go-version: 1.23 pin is also misleading about what toolchain actually builds the project.